General
-
Target
efde85682f97c656375e3f7a2da96c33_JaffaCakes118
-
Size
226KB
-
Sample
240415-aqcqcacc4y
-
MD5
efde85682f97c656375e3f7a2da96c33
-
SHA1
484437cd1b6f8fc7984d97023c2e7e4b2b90c077
-
SHA256
47add606e2f5ed4596bffd9f0345e35164c80071efbb0dc4e7b29d1d62391a6e
-
SHA512
634f7daa11a80887722e1bd341309bba8fcc78c39a5c562882c65ce0d5edbab180f3de4ec71191a6801d5b1533e85c5bb0e5b1cf01218d5579b81ea2500223cb
-
SSDEEP
6144:ND8O9Jho9mipRr/n2fkOyGLXZcJMvdSWLOrs+/sd2W:fbhotRn2fjkMOD69
Malware Config
Extracted
xloader
2.3
qb4a
travelsonabike2.net
eurekaprice.com
bkardd.com
vr893.com
nnsxykj.com
q-p.info
691485.com
magixe.com
frankysfurnituregallery.com
businessloansug.com
rocketcompaniesshady.info
lercoantincenti.com
pelosi4never.com
bide168.com
socialsecuritybonds.com
xn--hy1bj7gtvmh9a15t.com
anjaschaefer.net
wickedfavicon.com
bitesizedstudio.com
ecogiftsuk.com
Targets
-
-
Target
efde85682f97c656375e3f7a2da96c33_JaffaCakes118
-
Size
226KB
-
MD5
efde85682f97c656375e3f7a2da96c33
-
SHA1
484437cd1b6f8fc7984d97023c2e7e4b2b90c077
-
SHA256
47add606e2f5ed4596bffd9f0345e35164c80071efbb0dc4e7b29d1d62391a6e
-
SHA512
634f7daa11a80887722e1bd341309bba8fcc78c39a5c562882c65ce0d5edbab180f3de4ec71191a6801d5b1533e85c5bb0e5b1cf01218d5579b81ea2500223cb
-
SSDEEP
6144:ND8O9Jho9mipRr/n2fkOyGLXZcJMvdSWLOrs+/sd2W:fbhotRn2fjkMOD69
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-